@aglyn/plugins-commerce 1.0.0-beta.288 → 1.0.0-beta.290

package/src/lib/server/checkout-session-expiry.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Closing a Checkout Session so it can no longer be paid, and saying what it
+ * was (AGL-4094).
+ *
+ * Stripe answers 200 to `expire` for a session that was open, and 400 for one
+ * that is not — already expired, or already PAID. Those two must not be read
+ * alike: a caller about to open a fresh session for the same quote has to
+ * know that the old one was paid a moment ago, or it hands the customer a
+ * second way to pay. So a refused expiry reads the session back and answers
+ * its status.
+ *
+ * - `expired`: it can no longer be paid (it was open and is now closed, or it
+ *   had expired already).
+ * - `complete`: it was paid; the webhook has, or will, record it.
+ * - `missing`: Stripe does not know it (another mode's id, or never created).
+ * - `open`: it could not be closed and may still be paid. The caller treats
+ *   this as a failure to retry, never as closed.
+ */
+export type CheckoutSessionExpiry = 'expired' | 'complete' | 'missing' | 'open';
+export declare function expireCheckoutSession(sessionId: string): Promise<CheckoutSessionExpiry>;

package/src/lib/server/checkout-session-expiry.js

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Closing a Checkout Session so it can no longer be paid, and saying what it
+ * was (AGL-4094).
+ *
+ * Stripe answers 200 to `expire` for a session that was open, and 400 for one
+ * that is not — already expired, or already PAID. Those two must not be read
+ * alike: a caller about to open a fresh session for the same quote has to
+ * know that the old one was paid a moment ago, or it hands the customer a
+ * second way to pay. So a refused expiry reads the session back and answers
+ * its status.
+ *
+ * - `expired`: it can no longer be paid (it was open and is now closed, or it
+ *   had expired already).
+ * - `complete`: it was paid; the webhook has, or will, record it.
+ * - `missing`: Stripe does not know it (another mode's id, or never created).
+ * - `open`: it could not be closed and may still be paid. The caller treats
+ *   this as a failure to retry, never as closed.
+ */ const SESSION_ID = /^cs_(test|live)_[A-Za-z0-9]{8,255}$/;
+export async function expireCheckoutSession(sessionId) {
+    var _process_env_STRIPE_SECRET_KEY;
+    if (!SESSION_ID.test(String(sessionId != null ? sessionId : ''))) return 'missing';
+    const secretKey = String((_process_env_STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY) != null ? _process_env_STRIPE_SECRET_KEY : '').trim();
+    if (!secretKey) return 'open';
+    const headers = {
+        Authorization: `Bearer ${secretKey}`,
+        'Content-Type': 'application/x-www-form-urlencoded'
+    };
+    try {
+        const expired = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}/expire`, {
+            method: 'POST',
+            headers
+        });
+        if (expired.ok) return 'expired';
+        const read = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, {
+            headers
+        });
+        if (read.status === 404) return 'missing';
+        if (!read.ok) return 'open';
+        const session = await read.json().catch(()=>({}));
+        if (session.status === 'complete') return 'complete';
+        if (session.status === 'expired') return 'expired';
+        return 'open';
+    } catch (unused) {
+        return 'open';
+    }
+}
+
+//# sourceMappingURL=checkout-session-expiry.js.map

package/src/lib/server/checkout-session-expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/checkout-session-expiry.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Closing a Checkout Session so it can no longer be paid, and saying what it\n * was (AGL-4094).\n *\n * Stripe answers 200 to `expire` for a session that was open, and 400 for one\n * that is not — already expired, or already PAID. Those two must not be read\n * alike: a caller about to open a fresh session for the same quote has to\n * know that the old one was paid a moment ago, or it hands the customer a\n * second way to pay. So a refused expiry reads the session back and answers\n * its status.\n *\n * - `expired`: it can no longer be paid (it was open and is now closed, or it\n *   had expired already).\n * - `complete`: it was paid; the webhook has, or will, record it.\n * - `missing`: Stripe does not know it (another mode's id, or never created).\n * - `open`: it could not be closed and may still be paid. The caller treats\n *   this as a failure to retry, never as closed.\n */\nexport type CheckoutSessionExpiry = 'expired' | 'complete' | 'missing' | 'open'\n\nconst SESSION_ID = /^cs_(test|live)_[A-Za-z0-9]{8,255}$/\n\nexport async function expireCheckoutSession(sessionId: string): Promise<CheckoutSessionExpiry> {\n  if (!SESSION_ID.test(String(sessionId ?? ''))) return 'missing'\n  const secretKey = String(process.env.STRIPE_SECRET_KEY ?? '').trim()\n  if (!secretKey) return 'open'\n  const headers = {\n    Authorization: `Bearer ${secretKey}`,\n    'Content-Type': 'application/x-www-form-urlencoded',\n  }\n  try {\n    const expired = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}/expire`, {\n      method: 'POST',\n      headers,\n    })\n    if (expired.ok) return 'expired'\n    const read = await fetch(`https://api.stripe.com/v1/checkout/sessions/${sessionId}`, { headers })\n    if (read.status === 404) return 'missing'\n    if (!read.ok) return 'open'\n    const session = (await read.json().catch(() => ({}))) as { status?: string }\n    if (session.status === 'complete') return 'complete'\n    if (session.status === 'expired') return 'expired'\n    return 'open'\n  } catch {\n    return 'open'\n  }\n}\n"],"names":["SESSION_ID","expireCheckoutSession","sessionId","process","test","String","secretKey","env","STRIPE_SECRET_KEY","trim","headers","Authorization","expired","fetch","method","ok","read","status","session","json","catch"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;CAiBC,GAGD,MAAMA,aAAa;AAEnB,OAAO,eAAeC,sBAAsBC,SAAiB;QAElCC;IADzB,IAAI,CAACH,WAAWI,IAAI,CAACC,OAAOH,oBAAAA,YAAa,MAAM,OAAO;IACtD,MAAMI,YAAYD,QAAOF,iCAAAA,QAAQI,GAAG,CAACC,iBAAiB,YAA7BL,iCAAiC,IAAIM,IAAI;IAClE,IAAI,CAACH,WAAW,OAAO;IACvB,MAAMI,UAAU;QACdC,eAAe,CAAC,OAAO,EAAEL,WAAW;QACpC,gBAAgB;IAClB;IACA,IAAI;QACF,MAAMM,UAAU,MAAMC,MAAM,CAAC,4CAA4C,EAAEX,UAAU,OAAO,CAAC,EAAE;YAC7FY,QAAQ;YACRJ;QACF;QACA,IAAIE,QAAQG,EAAE,EAAE,OAAO;QACvB,MAAMC,OAAO,MAAMH,MAAM,CAAC,4CAA4C,EAAEX,WAAW,EAAE;YAAEQ;QAAQ;QAC/F,IAAIM,KAAKC,MAAM,KAAK,KAAK,OAAO;QAChC,IAAI,CAACD,KAAKD,EAAE,EAAE,OAAO;QACrB,MAAMG,UAAW,MAAMF,KAAKG,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QACjD,IAAIF,QAAQD,MAAM,KAAK,YAAY,OAAO;QAC1C,IAAIC,QAAQD,MAAM,KAAK,WAAW,OAAO;QACzC,OAAO;IACT,EAAE,eAAM;QACN,OAAO;IACT;AACF"}

package/src/lib/server/commerce-pdf.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler, PluginApiRequest } from '@aglyn/aglyn/server';
+import { type PdfJpegImage } from '@aglyn/shared-util-tools/pdf/pdf-file';
+import { loadSharp } from '@aglyn/tenant-data-admin/server/media-variants';
+import * as CommerceModel from '../model';
+import { type CommercePdfBrand, type CommercePdfColors } from '../utils/commerce-document-pdf';
+import { type CommercePdfFile } from './pdf-response';
+import { type QuoteLinkOutcome, type QuotePayDeps } from './quote-pay';
+type HostDocument = Record<string, unknown>;
+/**
+ * The business's contact as the document prints it: its postal address (a
+ * block of text, a line per line), the email visitors write to, its phone,
+ * and its web address without the scheme.
+ */
+export declare function commercePdfContactLines(host: HostDocument | null | undefined): string[];
+/** The site theme's colors for a document, or the neutral ones when the theme cannot be read. */
+export declare function commercePdfSiteColors(host: HostDocument | null | undefined): CommercePdfColors;
+/**
+ * A logo's bytes as a JPEG the PDF can carry: turned upright, fitted inside
+ * {@link LOGO_PIXELS}, transparency flattened onto white, and small enough to
+ * attach. Null when the bytes are not an image sharp reads.
+ */
+export declare function logoJpeg(source: Buffer, sharpFactory?: Awaited<ReturnType<typeof loadSharp>>): Promise<PdfJpegImage | null>;
+export interface CommercePdfBrandDeps {
+    /** The site's logo as a JPEG, or null; never throws. */
+    logo(input: {
+        hostId: string;
+        orgId: string;
+        value: string;
+    }): Promise<PdfJpegImage | null>;
+    orgForHost(hostId: string): Promise<{
+        id?: string;
+        org?: unknown;
+    } | null>;
+}
+export declare function defaultCommercePdfBrandDeps(): CommercePdfBrandDeps;
+/** Who a site's documents are from: its name, contact, colors, logo and time zone. */
+export declare function loadCommercePdfBrand(input: {
+    hostId: string;
+    host: HostDocument;
+    owner?: {
+        id?: string;
+        org?: unknown;
+    } | null;
+}, deps?: CommercePdfBrandDeps): Promise<CommercePdfBrand>;
+/** `acme-signs-quote-1042.pdf`: the business, the document and its number, in ASCII. */
+export declare function commercePdfFilename(businessName: string, document: 'quote' | 'invoice', number: unknown, docId: string): string;
+/** A quote's PDF: what its customer's page shows, from the business, with its pay link when given one. */
+export declare function quotePdfFile(input: {
+    hostId: string;
+    quoteId: string;
+    order: CommerceModel.HostOrder;
+    host: HostDocument;
+    store: HostDocument | null | undefined;
+    owner?: {
+        id?: string;
+        org?: unknown;
+    } | null;
+    /** Printed on a quote still to be paid; null leaves it off. */
+    payUrl: string | null;
+}, deps?: CommercePdfBrandDeps): Promise<CommercePdfFile>;
+/** An order's invoice PDF, a paid quote's included. */
+export declare function orderInvoicePdfFile(input: {
+    hostId: string;
+    orderId: string;
+    order: CommerceModel.HostOrder;
+    host: HostDocument;
+    store: HostDocument | null | undefined;
+    owner?: {
+        id?: string;
+        org?: unknown;
+    } | null;
+}, deps?: CommercePdfBrandDeps): Promise<CommercePdfFile>;
+/** Downloads one address may make per site, per ten minutes. */
+export declare const QUOTE_PDF_DOWNLOADS_PER_WINDOW = 20;
+export interface QuotePdfRouteDeps extends QuotePayDeps {
+    quotePdf: typeof quotePdfFile;
+}
+export declare function handleQuotePdf(deps: QuotePdfRouteDeps, req: PluginApiRequest): Promise<QuoteLinkOutcome | {
+    status: 200;
+    pdf: CommercePdfFile;
+}>;
+/** `GET /api/commerce/quote-pdf`. */
+export declare const quotePdfHandler: PluginApiHandler;
+export {};

package/src/lib/server/commerce-pdf.js

@@ -0,0 +1,283 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { resolveSiteTimeZone } from "@aglyn/aglyn/app-utils/collection-entry-date";
+import { resolveHostToken } from "@aglyn/aglyn/app-utils/host-tokens";
+import { resolveSiteTheme } from "@aglyn/aglyn/app-utils/site-theme";
+import { buildEmailPalette, emailPaletteBaseForHost } from "@aglyn/shared-util-email";
+import { readJpeg } from "@aglyn/shared-util-tools/pdf/pdf-file";
+import { getOrgForHost } from "@aglyn/tenant-data-admin";
+import { loadSharp } from "@aglyn/tenant-data-admin/server/media-variants";
+import * as CommerceModel from "../model/index.js";
+import { COMMERCE_PDF_NEUTRAL_COLORS, commercePdfColorsFromPalette, renderOrderInvoicePdf, renderQuotePdf } from "../utils/commerce-document-pdf.js";
+import { invoiceStoreFrom } from "../utils/order-invoice.js";
+import { orderStatusUrl } from "./order-status-token.js";
+import { sendPdf } from "./pdf-response.js";
+import { quotePayLinkUrl } from "./quote-link-token.js";
+import { defaultQuotePayDeps, limitedQuoteLink, loadLinkedQuote, quoteLinkParams, sendQuoteLinkOutcome } from "./quote-pay.js";
+import { locateImageSource, readImageSourceBytes } from "./site-image-source.js";
+/*==========================================
+ * A QUOTE'S AND AN ORDER'S PDF ON THE SERVER (AGL-4095).
+ *
+ * What the renderers in `utils/commerce-document-pdf.ts` are given comes from
+ * here: the site's business name and contact, its theme's colors, its logo
+ * (read from storage or its public address, converted to a JPEG on white by
+ * sharp, and left out when there is none or it cannot be read), its time
+ * zone, and the quote or order itself.
+ *
+ * Three doors use it, each loading this module only when it is asked for a
+ * PDF, so sharp and the PDF writer stay out of every other request:
+ *
+ *   POST commerce/quote { action: 'pdf' }                 the console's quote ("Create and edit quotes")
+ *   GET  commerce/order-print?kind=invoice-pdf             the console's and the apps' invoice ("Manage orders")
+ *   GET  commerce/quote-pdf?hostId=&q=&t=                  the customer's quote, by its signed link
+ *=========================================*/ /** A logo source larger than this is not read. */ const LOGO_SOURCE_MAX_BYTES = 10000000;
+/** The logo's pixels: about four times the box it is drawn in, never enlarged. */ const LOGO_PIXELS = {
+    width: 720,
+    height: 200
+};
+/** A converted logo larger than this is left out rather than bloat every copy of the document. */ const LOGO_MAX_JPEG_BYTES = 350000;
+/** A source whose decoded pixels exceed this is refused rather than decoded. */ const LOGO_MAX_INPUT_PIXELS = 50000000;
+/** The ground a logo's transparent pixels are flattened onto: the page's white. */ const LOGO_GROUND = {
+    r: 255,
+    g: 255,
+    b: 255
+};
+const trimmed = (value)=>typeof value === 'string' ? value.trim() : '';
+/**
+ * The business's contact as the document prints it: its postal address (a
+ * block of text, a line per line), the email visitors write to, its phone,
+ * and its web address without the scheme.
+ */ export function commercePdfContactLines(host) {
+    var _source_seo_entity, _source_seo, _source_business, _source_seo_entity1, _source_seo1;
+    const source = host != null ? host : {};
+    const address = trimmed(resolveHostToken('address', source)).split(/\r?\n/).map((line)=>line.trim()).filter(Boolean);
+    const email = trimmed((_source_seo = source.seo) == null ? void 0 : (_source_seo_entity = _source_seo.entity) == null ? void 0 : _source_seo_entity.email) || trimmed((_source_business = source.business) == null ? void 0 : _source_business.supportEmail);
+    const phone = trimmed((_source_seo1 = source.seo) == null ? void 0 : (_source_seo_entity1 = _source_seo1.entity) == null ? void 0 : _source_seo_entity1.telephone);
+    const site = trimmed(resolveHostToken('url', source)).replace(/^https?:\/\//, '').replace(/\/$/, '');
+    return [
+        ...address,
+        email,
+        phone,
+        site
+    ].filter(Boolean);
+}
+/** The site theme's colors for a document, or the neutral ones when the theme cannot be read. */ export function commercePdfSiteColors(host) {
+    try {
+        var _ref;
+        var _theme_colorSchemes;
+        const theme = resolveSiteTheme(host != null ? host : null);
+        return commercePdfColorsFromPalette(buildEmailPalette({
+            base: emailPaletteBaseForHost(host),
+            colors: (_ref = theme == null ? void 0 : (_theme_colorSchemes = theme.colorSchemes) == null ? void 0 : _theme_colorSchemes.light) != null ? _ref : null
+        }));
+    } catch (unused) {
+        return _extends({}, COMMERCE_PDF_NEUTRAL_COLORS);
+    }
+}
+/** sharp's decoding options; an SVG is rasterized dense enough for the logo's pixels. */ async function decodeOptions(sharp, source) {
+    var _meta_width, _meta_height;
+    const base = {
+        limitInputPixels: LOGO_MAX_INPUT_PIXELS,
+        failOn: 'error'
+    };
+    const meta = await sharp(source, base).metadata();
+    if (meta.format !== 'svg') return base;
+    const longest = Math.max((_meta_width = meta.width) != null ? _meta_width : 0, (_meta_height = meta.height) != null ? _meta_height : 0);
+    if (!longest) return base;
+    return _extends({}, base, {
+        density: Math.min(2400, Math.max(1, Math.ceil(72 * LOGO_PIXELS.width / longest)))
+    });
+}
+/**
+ * A logo's bytes as a JPEG the PDF can carry: turned upright, fitted inside
+ * {@link LOGO_PIXELS}, transparency flattened onto white, and small enough to
+ * attach. Null when the bytes are not an image sharp reads.
+ */ export async function logoJpeg(source, sharpFactory) {
+    const sharp = sharpFactory != null ? sharpFactory : await loadSharp();
+    const options = await decodeOptions(sharp, source);
+    for (const quality of [
+        86,
+        72
+    ]){
+        const jpeg = await sharp(source, options).rotate().resize(LOGO_PIXELS.width, LOGO_PIXELS.height, {
+            fit: 'inside',
+            withoutEnlargement: true
+        }).flatten({
+            background: LOGO_GROUND
+        }).jpeg({
+            quality
+        }).toBuffer();
+        if (jpeg.length <= LOGO_MAX_JPEG_BYTES) return readJpeg(new Uint8Array(jpeg));
+    }
+    return null;
+}
+export function defaultCommercePdfBrandDeps() {
+    return {
+        logo: async ({ hostId, orgId, value })=>{
+            try {
+                const located = await locateImageSource(value, hostId, orgId, LOGO_SOURCE_MAX_BYTES);
+                const bytes = located ? await readImageSourceBytes(located, LOGO_SOURCE_MAX_BYTES) : null;
+                return bytes ? await logoJpeg(bytes) : null;
+            } catch (error) {
+                console.warn('[commerce/pdf] the site logo was left out', error);
+                return null;
+            }
+        },
+        orgForHost: async (hostId)=>{
+            const found = await getOrgForHost(hostId);
+            return found ? {
+                id: found.orgId,
+                org: found.org
+            } : null;
+        }
+    };
+}
+/** Who a site's documents are from: its name, contact, colors, logo and time zone. */ export async function loadCommercePdfBrand(input, deps = defaultCommercePdfBrandDeps()) {
+    var _ref, _ref1;
+    const host = input.host;
+    const owner = input.owner === undefined ? await deps.orgForHost(input.hostId).catch(()=>null) : input.owner;
+    const logoValue = trimmed(resolveHostToken('logo', host));
+    const logo = logoValue ? await deps.logo({
+        hostId: input.hostId,
+        orgId: String((_ref = owner == null ? void 0 : owner.id) != null ? _ref : ''),
+        value: logoValue
+    }) : null;
+    return {
+        businessName: trimmed(resolveHostToken('businessName', host)) || trimmed(host['name']),
+        contactLines: commercePdfContactLines(host),
+        logo,
+        colors: commercePdfSiteColors(host),
+        timeZone: resolveSiteTimeZone((_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null, host)
+    };
+}
+/** `acme-signs-quote-1042.pdf`: the business, the document and its number, in ASCII. */ export function commercePdfFilename(businessName, document, number, docId) {
+    const slug = (value)=>value.normalize('NFKD').replace(/[̀-ͯ]/g, '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40);
+    const numbered = number != null && String(number).trim() ? String(number) : docId.slice(-6);
+    return `${[
+        slug(businessName),
+        document,
+        slug(numbered)
+    ].filter(Boolean).join('-')}.pdf`;
+}
+/** A quote's PDF: what its customer's page shows, from the business, with its pay link when given one. */ export async function quotePdfFile(input, deps) {
+    var _ref;
+    var _input_store, _input_order_quote;
+    const brand = await loadCommercePdfBrand({
+        hostId: input.hostId,
+        host: input.host,
+        owner: input.owner
+    }, deps);
+    const view = CommerceModel.buildQuotePageView({
+        order: input.order,
+        orderId: input.quoteId,
+        storeName: brand.businessName,
+        currency: String((_ref = (_input_store = input.store) == null ? void 0 : _input_store['currency']) != null ? _ref : 'USD'),
+        receiptUrl: CommerceModel.isUnpaidQuote(input.order) ? null : orderStatusUrl(input.host, input.hostId, input.quoteId)
+    });
+    return {
+        bytes: renderQuotePdf({
+            brand,
+            view,
+            revision: Number((_input_order_quote = input.order.quote) == null ? void 0 : _input_order_quote.revision) || 1,
+            payUrl: input.payUrl
+        }),
+        filename: commercePdfFilename(brand.businessName, 'quote', input.order.number, input.quoteId)
+    };
+}
+/** An order's invoice PDF, a paid quote's included. */ export async function orderInvoicePdfFile(input, deps) {
+    const brand = await loadCommercePdfBrand({
+        hostId: input.hostId,
+        host: input.host,
+        owner: input.owner
+    }, deps);
+    return {
+        bytes: renderOrderInvoicePdf({
+            brand,
+            order: input.order,
+            orderId: input.orderId,
+            store: invoiceStoreFrom(input.host, input.store)
+        }),
+        filename: commercePdfFilename(brand.businessName, 'invoice', input.order.number, input.orderId)
+    };
+}
+/*==========================================
+ * THE CUSTOMER'S DOWNLOAD: GET commerce/quote-pdf?hostId=&q=&t=
+ *
+ * The same signed link and the same rules as the quote page's data
+ * (`commerce/quote-view`): a wrong token answers exactly as a missing quote,
+ * a link to an older version of the quote is refused, and every address is
+ * rate-limited per site before the token is checked. The PDF is the page's
+ * own view, so it shows nothing the page does not.
+ *=========================================*/ /** Downloads one address may make per site, per ten minutes. */ export const QUOTE_PDF_DOWNLOADS_PER_WINDOW = 20;
+export async function handleQuotePdf(deps, req) {
+    var _req_query, _store_data;
+    if (req.method !== 'GET') return {
+        status: 405,
+        body: {
+            error: 'Method not allowed'
+        }
+    };
+    const { hostId, quoteId, token, complete } = quoteLinkParams((_req_query = req.query) != null ? _req_query : {});
+    if (!complete) return {
+        status: 400,
+        body: {
+            error: 'This link is incomplete.'
+        }
+    };
+    const refused = await limitedQuoteLink(deps, req, `commerce-quote-pdf:${hostId}`, QUOTE_PDF_DOWNLOADS_PER_WINDOW);
+    if (refused) return refused;
+    const linked = await loadLinkedQuote(deps, hostId, quoteId, token);
+    if ('outcome' in linked) return linked.outcome;
+    const { host, order, store } = linked.loaded;
+    const payUrl = CommerceModel.isUnpaidQuote(order) ? quotePayLinkUrl(host, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote)) : null;
+    const owner = await deps.orgForHost(hostId).catch(()=>null);
+    const pdf = await deps.quotePdf({
+        hostId,
+        quoteId,
+        order,
+        host,
+        store: (_store_data = store.data()) != null ? _store_data : null,
+        owner: owner ? {
+            id: owner.id,
+            org: owner.org
+        } : null,
+        payUrl
+    });
+    return {
+        status: 200,
+        pdf
+    };
+}
+/** `GET /api/commerce/quote-pdf`. */ export const quotePdfHandler = async (req, res)=>{
+    try {
+        const outcome = await handleQuotePdf(_extends({}, defaultQuotePayDeps(), {
+            quotePdf: quotePdfFile
+        }), req);
+        if ('pdf' in outcome) return sendPdf(res, outcome.pdf);
+        return sendQuoteLinkOutcome(res, outcome);
+    } catch (error) {
+        console.error('quote pdf failed', error);
+        return sendQuoteLinkOutcome(res, {
+            status: 500,
+            body: {
+                error: 'This quote could not be made into a PDF. Try again.'
+            }
+        });
+    }
+};
+
+//# sourceMappingURL=commerce-pdf.js.map

package/src/lib/server/commerce-pdf.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/commerce-pdf.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler, PluginApiRequest } from '@aglyn/aglyn/server'\nimport { resolveSiteTimeZone } from '@aglyn/aglyn/app-utils/collection-entry-date'\nimport { resolveHostToken, type HostTokenSource } from '@aglyn/aglyn/app-utils/host-tokens'\nimport { resolveSiteTheme, type ThemeHostDocument } from '@aglyn/aglyn/app-utils/site-theme'\nimport { buildEmailPalette, emailPaletteBaseForHost } from '@aglyn/shared-util-email'\nimport { readJpeg, type PdfJpegImage } from '@aglyn/shared-util-tools/pdf/pdf-file'\nimport { getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { loadSharp } from '@aglyn/tenant-data-admin/server/media-variants'\nimport * as CommerceModel from '../model'\nimport {\n  COMMERCE_PDF_NEUTRAL_COLORS,\n  commercePdfColorsFromPalette,\n  renderOrderInvoicePdf,\n  renderQuotePdf,\n  type CommercePdfBrand,\n  type CommercePdfColors,\n} from '../utils/commerce-document-pdf'\nimport { invoiceStoreFrom } from '../utils/order-invoice'\nimport { orderStatusUrl } from './order-status-token'\nimport { sendPdf, type CommercePdfFile } from './pdf-response'\nimport { quotePayLinkUrl } from './quote-link-token'\nimport {\n  defaultQuotePayDeps,\n  limitedQuoteLink,\n  loadLinkedQuote,\n  quoteLinkParams,\n  sendQuoteLinkOutcome,\n  type QuoteLinkOutcome,\n  type QuotePayDeps,\n} from './quote-pay'\nimport { locateImageSource, readImageSourceBytes } from './site-image-source'\n\n/*==========================================\n * A QUOTE'S AND AN ORDER'S PDF ON THE SERVER (AGL-4095).\n *\n * What the renderers in `utils/commerce-document-pdf.ts` are given comes from\n * here: the site's business name and contact, its theme's colors, its logo\n * (read from storage or its public address, converted to a JPEG on white by\n * sharp, and left out when there is none or it cannot be read), its time\n * zone, and the quote or order itself.\n *\n * Three doors use it, each loading this module only when it is asked for a\n * PDF, so sharp and the PDF writer stay out of every other request:\n *\n *   POST commerce/quote { action: 'pdf' }                 the console's quote (\"Create and edit quotes\")\n *   GET  commerce/order-print?kind=invoice-pdf             the console's and the apps' invoice (\"Manage orders\")\n *   GET  commerce/quote-pdf?hostId=&q=&t=                  the customer's quote, by its signed link\n *=========================================*/\n\n/** A logo source larger than this is not read. */\nconst LOGO_SOURCE_MAX_BYTES = 10_000_000\n\n/** The logo's pixels: about four times the box it is drawn in, never enlarged. */\nconst LOGO_PIXELS = { width: 720, height: 200 } as const\n\n/** A converted logo larger than this is left out rather than bloat every copy of the document. */\nconst LOGO_MAX_JPEG_BYTES = 350_000\n\n/** A source whose decoded pixels exceed this is refused rather than decoded. */\nconst LOGO_MAX_INPUT_PIXELS = 50_000_000\n\n/** The ground a logo's transparent pixels are flattened onto: the page's white. */\nconst LOGO_GROUND = { r: 255, g: 255, b: 255 } as const\n\ntype HostDocument = Record<string, unknown>\n\nconst trimmed = (value: unknown): string => (typeof value === 'string' ? value.trim() : '')\n\n/**\n * The business's contact as the document prints it: its postal address (a\n * block of text, a line per line), the email visitors write to, its phone,\n * and its web address without the scheme.\n */\nexport function commercePdfContactLines(host: HostDocument | null | undefined): string[] {\n  const source = (host ?? {}) as HostTokenSource & {\n    seo?: { entity?: { email?: unknown; telephone?: unknown } }\n    business?: { supportEmail?: unknown }\n  }\n  const address = trimmed(resolveHostToken('address', source))\n    .split(/\\r?\\n/)\n    .map((line) => line.trim())\n    .filter(Boolean)\n  const email = trimmed(source.seo?.entity?.email) || trimmed(source.business?.supportEmail)\n  const phone = trimmed(source.seo?.entity?.telephone)\n  const site = trimmed(resolveHostToken('url', source)).replace(/^https?:\\/\\//, '').replace(/\\/$/, '')\n  return [...address, email, phone, site].filter(Boolean)\n}\n\n/** The site theme's colors for a document, or the neutral ones when the theme cannot be read. */\nexport function commercePdfSiteColors(host: HostDocument | null | undefined): CommercePdfColors {\n  try {\n    const theme = resolveSiteTheme((host ?? null) as ThemeHostDocument | null)\n    return commercePdfColorsFromPalette(\n      buildEmailPalette({\n        base: emailPaletteBaseForHost(host as { cname?: string; subdomain?: string } | null),\n        colors: (theme?.colorSchemes?.light ?? null) as Record<string, unknown> | null,\n      }),\n    )\n  } catch {\n    return { ...COMMERCE_PDF_NEUTRAL_COLORS }\n  }\n}\n\n/** sharp's decoding options; an SVG is rasterized dense enough for the logo's pixels. */\nasync function decodeOptions(sharp: Awaited<ReturnType<typeof loadSharp>>, source: Buffer) {\n  const base = { limitInputPixels: LOGO_MAX_INPUT_PIXELS, failOn: 'error' as const }\n  const meta = await sharp(source, base).metadata()\n  if (meta.format !== 'svg') return base\n  const longest = Math.max(meta.width ?? 0, meta.height ?? 0)\n  if (!longest) return base\n  return { ...base, density: Math.min(2400, Math.max(1, Math.ceil((72 * LOGO_PIXELS.width) / longest))) }\n}\n\n/**\n * A logo's bytes as a JPEG the PDF can carry: turned upright, fitted inside\n * {@link LOGO_PIXELS}, transparency flattened onto white, and small enough to\n * attach. Null when the bytes are not an image sharp reads.\n */\nexport async function logoJpeg(source: Buffer, sharpFactory?: Awaited<ReturnType<typeof loadSharp>>): Promise<PdfJpegImage | null> {\n  const sharp = sharpFactory ?? (await loadSharp())\n  const options = await decodeOptions(sharp, source)\n  for (const quality of [86, 72]) {\n    const jpeg = await sharp(source, options)\n      .rotate()\n      .resize(LOGO_PIXELS.width, LOGO_PIXELS.height, { fit: 'inside', withoutEnlargement: true })\n      .flatten({ background: LOGO_GROUND })\n      .jpeg({ quality })\n      .toBuffer()\n    if (jpeg.length <= LOGO_MAX_JPEG_BYTES) return readJpeg(new Uint8Array(jpeg))\n  }\n  return null\n}\n\nexport interface CommercePdfBrandDeps {\n  /** The site's logo as a JPEG, or null; never throws. */\n  logo(input: { hostId: string; orgId: string; value: string }): Promise<PdfJpegImage | null>\n  orgForHost(hostId: string): Promise<{ id?: string; org?: unknown } | null>\n}\n\nexport function defaultCommercePdfBrandDeps(): CommercePdfBrandDeps {\n  return {\n    logo: async ({ hostId, orgId, value }) => {\n      try {\n        const located = await locateImageSource(value, hostId, orgId, LOGO_SOURCE_MAX_BYTES)\n        const bytes = located ? await readImageSourceBytes(located, LOGO_SOURCE_MAX_BYTES) : null\n        return bytes ? await logoJpeg(bytes) : null\n      } catch (error) {\n        console.warn('[commerce/pdf] the site logo was left out', error)\n        return null\n      }\n    },\n    orgForHost: async (hostId) => {\n      const found = await getOrgForHost(hostId)\n      return found ? { id: found.orgId, org: found.org } : null\n    },\n  }\n}\n\n/** Who a site's documents are from: its name, contact, colors, logo and time zone. */\nexport async function loadCommercePdfBrand(\n  input: { hostId: string; host: HostDocument; owner?: { id?: string; org?: unknown } | null },\n  deps: CommercePdfBrandDeps = defaultCommercePdfBrandDeps(),\n): Promise<CommercePdfBrand> {\n  const host = input.host\n  const owner = input.owner === undefined ? await deps.orgForHost(input.hostId).catch(() => null) : input.owner\n  const logoValue = trimmed(resolveHostToken('logo', host as HostTokenSource))\n  const logo = logoValue ? await deps.logo({ hostId: input.hostId, orgId: String(owner?.id ?? ''), value: logoValue }) : null\n  return {\n    businessName: trimmed(resolveHostToken('businessName', host as HostTokenSource)) || trimmed(host['name']),\n    contactLines: commercePdfContactLines(host),\n    logo,\n    colors: commercePdfSiteColors(host),\n    timeZone: resolveSiteTimeZone(\n      (owner?.org ?? null) as { timeZone?: string } | null,\n      host as { timeZone?: string },\n    ),\n  }\n}\n\n/** `acme-signs-quote-1042.pdf`: the business, the document and its number, in ASCII. */\nexport function commercePdfFilename(businessName: string, document: 'quote' | 'invoice', number: unknown, docId: string): string {\n  const slug = (value: string) =>\n    value\n      .normalize('NFKD')\n      .replace(/[̀-ͯ]/g, '')\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, '-')\n      .replace(/^-+|-+$/g, '')\n      .slice(0, 40)\n  const numbered = number != null && String(number).trim() ? String(number) : docId.slice(-6)\n  return `${[slug(businessName), document, slug(numbered)].filter(Boolean).join('-')}.pdf`\n}\n\n/** A quote's PDF: what its customer's page shows, from the business, with its pay link when given one. */\nexport async function quotePdfFile(\n  input: {\n    hostId: string\n    quoteId: string\n    order: CommerceModel.HostOrder\n    host: HostDocument\n    store: HostDocument | null | undefined\n    owner?: { id?: string; org?: unknown } | null\n    /** Printed on a quote still to be paid; null leaves it off. */\n    payUrl: string | null\n  },\n  deps?: CommercePdfBrandDeps,\n): Promise<CommercePdfFile> {\n  const brand = await loadCommercePdfBrand({ hostId: input.hostId, host: input.host, owner: input.owner }, deps)\n  const view = CommerceModel.buildQuotePageView({\n    order: input.order,\n    orderId: input.quoteId,\n    storeName: brand.businessName,\n    currency: String(input.store?.['currency'] ?? 'USD'),\n    receiptUrl: CommerceModel.isUnpaidQuote(input.order) ? null : orderStatusUrl(input.host, input.hostId, input.quoteId),\n  })\n  return {\n    bytes: renderQuotePdf({ brand, view, revision: Number(input.order.quote?.revision) || 1, payUrl: input.payUrl }),\n    filename: commercePdfFilename(brand.businessName, 'quote', input.order.number, input.quoteId),\n  }\n}\n\n/** An order's invoice PDF, a paid quote's included. */\nexport async function orderInvoicePdfFile(\n  input: {\n    hostId: string\n    orderId: string\n    order: CommerceModel.HostOrder\n    host: HostDocument\n    store: HostDocument | null | undefined\n    owner?: { id?: string; org?: unknown } | null\n  },\n  deps?: CommercePdfBrandDeps,\n): Promise<CommercePdfFile> {\n  const brand = await loadCommercePdfBrand({ hostId: input.hostId, host: input.host, owner: input.owner }, deps)\n  return {\n    bytes: renderOrderInvoicePdf({\n      brand,\n      order: input.order,\n      orderId: input.orderId,\n      store: invoiceStoreFrom(input.host, input.store),\n    }),\n    filename: commercePdfFilename(brand.businessName, 'invoice', input.order.number, input.orderId),\n  }\n}\n\n/*==========================================\n * THE CUSTOMER'S DOWNLOAD: GET commerce/quote-pdf?hostId=&q=&t=\n *\n * The same signed link and the same rules as the quote page's data\n * (`commerce/quote-view`): a wrong token answers exactly as a missing quote,\n * a link to an older version of the quote is refused, and every address is\n * rate-limited per site before the token is checked. The PDF is the page's\n * own view, so it shows nothing the page does not.\n *=========================================*/\n\n/** Downloads one address may make per site, per ten minutes. */\nexport const QUOTE_PDF_DOWNLOADS_PER_WINDOW = 20\n\nexport interface QuotePdfRouteDeps extends QuotePayDeps {\n  quotePdf: typeof quotePdfFile\n}\n\nexport async function handleQuotePdf(\n  deps: QuotePdfRouteDeps,\n  req: PluginApiRequest,\n): Promise<QuoteLinkOutcome | { status: 200; pdf: CommercePdfFile }> {\n  if (req.method !== 'GET') return { status: 405, body: { error: 'Method not allowed' } }\n  const { hostId, quoteId, token, complete } = quoteLinkParams((req.query ?? {}) as Record<string, unknown>)\n  if (!complete) return { status: 400, body: { error: 'This link is incomplete.' } }\n  const refused = await limitedQuoteLink(deps, req, `commerce-quote-pdf:${hostId}`, QUOTE_PDF_DOWNLOADS_PER_WINDOW)\n  if (refused) return refused\n  const linked = await loadLinkedQuote(deps, hostId, quoteId, token)\n  if ('outcome' in linked) return linked.outcome\n  const { host, order, store } = linked.loaded\n  const payUrl = CommerceModel.isUnpaidQuote(order)\n    ? quotePayLinkUrl(host, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote))\n    : null\n  const owner = await deps.orgForHost(hostId).catch(() => null)\n  const pdf = await deps.quotePdf({\n    hostId,\n    quoteId,\n    order,\n    host,\n    store: (store.data() ?? null) as HostDocument | null,\n    owner: owner ? { id: owner.id, org: owner.org } : null,\n    payUrl,\n  })\n  return { status: 200, pdf }\n}\n\n/** `GET /api/commerce/quote-pdf`. */\nexport const quotePdfHandler: PluginApiHandler = async (req, res) => {\n  try {\n    const outcome = await handleQuotePdf({ ...defaultQuotePayDeps(), quotePdf: quotePdfFile }, req)\n    if ('pdf' in outcome) return sendPdf(res, outcome.pdf)\n    return sendQuoteLinkOutcome(res, outcome)\n  } catch (error) {\n    console.error('quote pdf failed', error)\n    return sendQuoteLinkOutcome(res, { status: 500, body: { error: 'This quote could not be made into a PDF. Try again.' } })\n  }\n}\n"],"names":["resolveSiteTimeZone","resolveHostToken","resolveSiteTheme","buildEmailPalette","emailPaletteBaseForHost","readJpeg","getOrgForHost","loadSharp","CommerceModel","COMMERCE_PDF_NEUTRAL_COLORS","commercePdfColorsFromPalette","renderOrderInvoicePdf","renderQuotePdf","invoiceStoreFrom","orderStatusUrl","sendPdf","quotePayLinkUrl","defaultQuotePayDeps","limitedQuoteLink","loadLinkedQuote","quoteLinkParams","sendQuoteLinkOutcome","locateImageSource","readImageSourceBytes","LOGO_SOURCE_MAX_BYTES","LOGO_PIXELS","width","height","LOGO_MAX_JPEG_BYTES","LOGO_MAX_INPUT_PIXELS","LOGO_GROUND","r","g","b","trimmed","value","trim","commercePdfContactLines","host","source","address","split","map","line","filter","Boolean","email","seo","entity","business","supportEmail","phone","telephone","site","replace","commercePdfSiteColors","theme","base","colors","colorSchemes","light","decodeOptions","sharp","meta","limitInputPixels","failOn","metadata","format","longest","Math","max","density","min","ceil","logoJpeg","sharpFactory","options","quality","jpeg","rotate","resize","fit","withoutEnlargement","flatten","background","toBuffer","length","Uint8Array","defaultCommercePdfBrandDeps","logo","hostId","orgId","located","bytes","error","console","warn","orgForHost","found","id","org","loadCommercePdfBrand","input","deps","owner","undefined","catch","logoValue","String","businessName","contactLines","timeZone","commercePdfFilename","document","number","docId","slug","normalize","toLowerCase","slice","numbered","join","quotePdfFile","brand","view","buildQuotePageView","order","orderId","quoteId","storeName","currency","store","receiptUrl","isUnpaidQuote","revision","Number","quote","payUrl","filename","orderInvoicePdfFile","QUOTE_PDF_DOWNLOADS_PER_WINDOW","handleQuotePdf","req","method","status","body","token","complete","query","refused","linked","outcome","loaded","quoteLinkVersion","pdf","quotePdf","data","quotePdfHandler","res"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,mBAAmB,QAAQ,+CAA8C;AAClF,SAASC,gBAAgB,QAA8B,qCAAoC;AAC3F,SAASC,gBAAgB,QAAgC,oCAAmC;AAC5F,SAASC,iBAAiB,EAAEC,uBAAuB,QAAQ,2BAA0B;AACrF,SAASC,QAAQ,QAA2B,wCAAuC;AACnF,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,SAAS,QAAQ,iDAAgD;AAC1E,YAAYC,mBAAmB,oBAAU;AACzC,SACEC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,qBAAqB,EACrBC,cAAc,QAGT,oCAAgC;AACvC,SAASC,gBAAgB,QAAQ,4BAAwB;AACzD,SAASC,cAAc,QAAQ,0BAAsB;AACrD,SAASC,OAAO,QAA8B,oBAAgB;AAC9D,SAASC,eAAe,QAAQ,wBAAoB;AACpD,SACEC,mBAAmB,EACnBC,gBAAgB,EAChBC,eAAe,EACfC,eAAe,EACfC,oBAAoB,QAGf,iBAAa;AACpB,SAASC,iBAAiB,EAAEC,oBAAoB,QAAQ,yBAAqB;AAE7E;;;;;;;;;;;;;;;2CAe2C,GAE3C,gDAAgD,GAChD,MAAMC,wBAAwB;AAE9B,gFAAgF,GAChF,MAAMC,cAAc;IAAEC,OAAO;IAAKC,QAAQ;AAAI;AAE9C,gGAAgG,GAChG,MAAMC,sBAAsB;AAE5B,8EAA8E,GAC9E,MAAMC,wBAAwB;AAE9B,iFAAiF,GACjF,MAAMC,cAAc;IAAEC,GAAG;IAAKC,GAAG;IAAKC,GAAG;AAAI;AAI7C,MAAMC,UAAU,CAACC,QAA4B,OAAOA,UAAU,WAAWA,MAAMC,IAAI,KAAK;AAExF;;;;CAIC,GACD,OAAO,SAASC,wBAAwBC,IAAqC;QASrDC,oBAAAA,aAAsCA,kBACtCA,qBAAAA;IATtB,MAAMA,SAAUD,eAAAA,OAAQ,CAAC;IAIzB,MAAME,UAAUN,QAAQjC,iBAAiB,WAAWsC,SACjDE,KAAK,CAAC,SACNC,GAAG,CAAC,CAACC,OAASA,KAAKP,IAAI,IACvBQ,MAAM,CAACC;IACV,MAAMC,QAAQZ,SAAQK,cAAAA,OAAOQ,GAAG,sBAAVR,qBAAAA,YAAYS,MAAM,qBAAlBT,mBAAoBO,KAAK,KAAKZ,SAAQK,mBAAAA,OAAOU,QAAQ,qBAAfV,iBAAiBW,YAAY;IACzF,MAAMC,QAAQjB,SAAQK,eAAAA,OAAOQ,GAAG,sBAAVR,sBAAAA,aAAYS,MAAM,qBAAlBT,oBAAoBa,SAAS;IACnD,MAAMC,OAAOnB,QAAQjC,iBAAiB,OAAOsC,SAASe,OAAO,CAAC,gBAAgB,IAAIA,OAAO,CAAC,OAAO;IACjG,OAAO;WAAId;QAASM;QAAOK;QAAOE;KAAK,CAACT,MAAM,CAACC;AACjD;AAEA,+FAA+F,GAC/F,OAAO,SAASU,sBAAsBjB,IAAqC;IACzE,IAAI;;YAKWkB;QAJb,MAAMA,QAAQtD,iBAAkBoC,eAAAA,OAAQ;QACxC,OAAO5B,6BACLP,kBAAkB;YAChBsD,MAAMrD,wBAAwBkC;YAC9BoB,MAAM,UAAGF,0BAAAA,sBAAAA,MAAOG,YAAY,qBAAnBH,oBAAqBI,KAAK,mBAAI;QACzC;IAEJ,EAAE,eAAM;QACN,OAAO,aAAKnD;IACd;AACF;AAEA,uFAAuF,GACvF,eAAeoD,cAAcC,KAA4C,EAAEvB,MAAc;QAI9DwB,aAAiBA;IAH1C,MAAMN,OAAO;QAAEO,kBAAkBnC;QAAuBoC,QAAQ;IAAiB;IACjF,MAAMF,OAAO,MAAMD,MAAMvB,QAAQkB,MAAMS,QAAQ;IAC/C,IAAIH,KAAKI,MAAM,KAAK,OAAO,OAAOV;IAClC,MAAMW,UAAUC,KAAKC,GAAG,EAACP,cAAAA,KAAKrC,KAAK,YAAVqC,cAAc,IAAGA,eAAAA,KAAKpC,MAAM,YAAXoC,eAAe;IACzD,IAAI,CAACK,SAAS,OAAOX;IACrB,OAAO,aAAKA;QAAMc,SAASF,KAAKG,GAAG,CAAC,MAAMH,KAAKC,GAAG,CAAC,GAAGD,KAAKI,IAAI,CAAC,AAAC,KAAKhD,YAAYC,KAAK,GAAI0C;;AAC7F;AAEA;;;;CAIC,GACD,OAAO,eAAeM,SAASnC,MAAc,EAAEoC,YAAoD;IACjG,MAAMb,QAAQa,uBAAAA,eAAiB,MAAMpE;IACrC,MAAMqE,UAAU,MAAMf,cAAcC,OAAOvB;IAC3C,KAAK,MAAMsC,WAAW;QAAC;QAAI;KAAG,CAAE;QAC9B,MAAMC,OAAO,MAAMhB,MAAMvB,QAAQqC,SAC9BG,MAAM,GACNC,MAAM,CAACvD,YAAYC,KAAK,EAAED,YAAYE,MAAM,EAAE;YAAEsD,KAAK;YAAUC,oBAAoB;QAAK,GACxFC,OAAO,CAAC;YAAEC,YAAYtD;QAAY,GAClCgD,IAAI,CAAC;YAAED;QAAQ,GACfQ,QAAQ;QACX,IAAIP,KAAKQ,MAAM,IAAI1D,qBAAqB,OAAOvB,SAAS,IAAIkF,WAAWT;IACzE;IACA,OAAO;AACT;AAQA,OAAO,SAASU;IACd,OAAO;QACLC,MAAM,OAAO,EAAEC,MAAM,EAAEC,KAAK,EAAExD,KAAK,EAAE;YACnC,IAAI;gBACF,MAAMyD,UAAU,MAAMtE,kBAAkBa,OAAOuD,QAAQC,OAAOnE;gBAC9D,MAAMqE,QAAQD,UAAU,MAAMrE,qBAAqBqE,SAASpE,yBAAyB;gBACrF,OAAOqE,QAAQ,MAAMnB,SAASmB,SAAS;YACzC,EAAE,OAAOC,OAAO;gBACdC,QAAQC,IAAI,CAAC,6CAA6CF;gBAC1D,OAAO;YACT;QACF;QACAG,YAAY,OAAOP;YACjB,MAAMQ,QAAQ,MAAM5F,cAAcoF;YAClC,OAAOQ,QAAQ;gBAAEC,IAAID,MAAMP,KAAK;gBAAES,KAAKF,MAAME,GAAG;YAAC,IAAI;QACvD;IACF;AACF;AAEA,oFAAoF,GACpF,OAAO,eAAeC,qBACpBC,KAA4F,EAC5FC,OAA6Bf,6BAA6B;;IAE1D,MAAMlD,OAAOgE,MAAMhE,IAAI;IACvB,MAAMkE,QAAQF,MAAME,KAAK,KAAKC,YAAY,MAAMF,KAAKN,UAAU,CAACK,MAAMZ,MAAM,EAAEgB,KAAK,CAAC,IAAM,QAAQJ,MAAME,KAAK;IAC7G,MAAMG,YAAYzE,QAAQjC,iBAAiB,QAAQqC;IACnD,MAAMmD,OAAOkB,YAAY,MAAMJ,KAAKd,IAAI,CAAC;QAAEC,QAAQY,MAAMZ,MAAM;QAAEC,OAAOiB,eAAOJ,yBAAAA,MAAOL,EAAE,mBAAI;QAAKhE,OAAOwE;IAAU,KAAK;IACvH,OAAO;QACLE,cAAc3E,QAAQjC,iBAAiB,gBAAgBqC,UAA6BJ,QAAQI,IAAI,CAAC,OAAO;QACxGwE,cAAczE,wBAAwBC;QACtCmD;QACA/B,QAAQH,sBAAsBjB;QAC9ByE,UAAU/G,6BACPwG,yBAAAA,MAAOJ,GAAG,oBAAI,MACf9D;IAEJ;AACF;AAEA,sFAAsF,GACtF,OAAO,SAAS0E,oBAAoBH,YAAoB,EAAEI,QAA6B,EAAEC,MAAe,EAAEC,KAAa;IACrH,MAAMC,OAAO,CAACjF,QACZA,MACGkF,SAAS,CAAC,QACV/D,OAAO,CAAC,UAAU,IAClBgE,WAAW,GACXhE,OAAO,CAAC,eAAe,KACvBA,OAAO,CAAC,YAAY,IACpBiE,KAAK,CAAC,GAAG;IACd,MAAMC,WAAWN,UAAU,QAAQN,OAAOM,QAAQ9E,IAAI,KAAKwE,OAAOM,UAAUC,MAAMI,KAAK,CAAC,CAAC;IACzF,OAAO,GAAG;QAACH,KAAKP;QAAeI;QAAUG,KAAKI;KAAU,CAAC5E,MAAM,CAACC,SAAS4E,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1F;AAEA,wGAAwG,GACxG,OAAO,eAAeC,aACpBpB,KASC,EACDC,IAA2B;;QAORD,cAIqCA;IATxD,MAAMqB,QAAQ,MAAMtB,qBAAqB;QAAEX,QAAQY,MAAMZ,MAAM;QAAEpD,MAAMgE,MAAMhE,IAAI;QAAEkE,OAAOF,MAAME,KAAK;IAAC,GAAGD;IACzG,MAAMqB,OAAOpH,cAAcqH,kBAAkB,CAAC;QAC5CC,OAAOxB,MAAMwB,KAAK;QAClBC,SAASzB,MAAM0B,OAAO;QACtBC,WAAWN,MAAMd,YAAY;QAC7BqB,UAAUtB,gBAAON,eAAAA,MAAM6B,KAAK,qBAAX7B,YAAa,CAAC,WAAW,mBAAI;QAC9C8B,YAAY5H,cAAc6H,aAAa,CAAC/B,MAAMwB,KAAK,IAAI,OAAOhH,eAAewF,MAAMhE,IAAI,EAAEgE,MAAMZ,MAAM,EAAEY,MAAM0B,OAAO;IACtH;IACA,OAAO;QACLnC,OAAOjF,eAAe;YAAE+G;YAAOC;YAAMU,UAAUC,QAAOjC,qBAAAA,MAAMwB,KAAK,CAACU,KAAK,qBAAjBlC,mBAAmBgC,QAAQ,KAAK;YAAGG,QAAQnC,MAAMmC,MAAM;QAAC;QAC9GC,UAAU1B,oBAAoBW,MAAMd,YAAY,EAAE,SAASP,MAAMwB,KAAK,CAACZ,MAAM,EAAEZ,MAAM0B,OAAO;IAC9F;AACF;AAEA,qDAAqD,GACrD,OAAO,eAAeW,oBACpBrC,KAOC,EACDC,IAA2B;IAE3B,MAAMoB,QAAQ,MAAMtB,qBAAqB;QAAEX,QAAQY,MAAMZ,MAAM;QAAEpD,MAAMgE,MAAMhE,IAAI;QAAEkE,OAAOF,MAAME,KAAK;IAAC,GAAGD;IACzG,OAAO;QACLV,OAAOlF,sBAAsB;YAC3BgH;YACAG,OAAOxB,MAAMwB,KAAK;YAClBC,SAASzB,MAAMyB,OAAO;YACtBI,OAAOtH,iBAAiByF,MAAMhE,IAAI,EAAEgE,MAAM6B,KAAK;QACjD;QACAO,UAAU1B,oBAAoBW,MAAMd,YAAY,EAAE,WAAWP,MAAMwB,KAAK,CAACZ,MAAM,EAAEZ,MAAMyB,OAAO;IAChG;AACF;AAEA;;;;;;;;2CAQ2C,GAE3C,8DAA8D,GAC9D,OAAO,MAAMa,iCAAiC,GAAE;AAMhD,OAAO,eAAeC,eACpBtC,IAAuB,EACvBuC,GAAqB;QAGyCA,YAgBpDX;IAjBV,IAAIW,IAAIC,MAAM,KAAK,OAAO,OAAO;QAAEC,QAAQ;QAAKC,MAAM;YAAEnD,OAAO;QAAqB;IAAE;IACtF,MAAM,EAAEJ,MAAM,EAAEsC,OAAO,EAAEkB,KAAK,EAAEC,QAAQ,EAAE,GAAG/H,iBAAiB0H,aAAAA,IAAIM,KAAK,YAATN,aAAa,CAAC;IAC5E,IAAI,CAACK,UAAU,OAAO;QAAEH,QAAQ;QAAKC,MAAM;YAAEnD,OAAO;QAA2B;IAAE;IACjF,MAAMuD,UAAU,MAAMnI,iBAAiBqF,MAAMuC,KAAK,CAAC,mBAAmB,EAAEpD,QAAQ,EAAEkD;IAClF,IAAIS,SAAS,OAAOA;IACpB,MAAMC,SAAS,MAAMnI,gBAAgBoF,MAAMb,QAAQsC,SAASkB;IAC5D,IAAI,aAAaI,QAAQ,OAAOA,OAAOC,OAAO;IAC9C,MAAM,EAAEjH,IAAI,EAAEwF,KAAK,EAAEK,KAAK,EAAE,GAAGmB,OAAOE,MAAM;IAC5C,MAAMf,SAASjI,cAAc6H,aAAa,CAACP,SACvC9G,gBAAgBsB,MAAMoD,QAAQsC,SAASxH,cAAciJ,gBAAgB,CAAC3B,MAAMU,KAAK,KACjF;IACJ,MAAMhC,QAAQ,MAAMD,KAAKN,UAAU,CAACP,QAAQgB,KAAK,CAAC,IAAM;IACxD,MAAMgD,MAAM,MAAMnD,KAAKoD,QAAQ,CAAC;QAC9BjE;QACAsC;QACAF;QACAxF;QACA6F,KAAK,GAAGA,cAAAA,MAAMyB,IAAI,cAAVzB,cAAgB;QACxB3B,OAAOA,QAAQ;YAAEL,IAAIK,MAAML,EAAE;YAAEC,KAAKI,MAAMJ,GAAG;QAAC,IAAI;QAClDqC;IACF;IACA,OAAO;QAAEO,QAAQ;QAAKU;IAAI;AAC5B;AAEA,mCAAmC,GACnC,OAAO,MAAMG,kBAAoC,OAAOf,KAAKgB;IAC3D,IAAI;QACF,MAAMP,UAAU,MAAMV,eAAe,aAAK5H;YAAuB0I,UAAUjC;YAAgBoB;QAC3F,IAAI,SAASS,SAAS,OAAOxI,QAAQ+I,KAAKP,QAAQG,GAAG;QACrD,OAAOrI,qBAAqByI,KAAKP;IACnC,EAAE,OAAOzD,OAAO;QACdC,QAAQD,KAAK,CAAC,oBAAoBA;QAClC,OAAOzE,qBAAqByI,KAAK;YAAEd,QAAQ;YAAKC,MAAM;gBAAEnD,OAAO;YAAsD;QAAE;IACzH;AACF,EAAC"}

package/src/lib/server/draft-order.js

@@ -23,6 +23,7 @@ import { merchantAccountIsReady } from "@aglyn/tenant-data-admin/server/payment-
 import { checkoutSessionCardAuthenticationParams } from "@aglyn/tenant-data-admin/server/stripe-card-authentication";
 import { planCheckoutShippingWithCarriers } from "./carrier-shipping.js";
 import { resolveManualTaxRateId } from "./manual-tax-rate.js";
+import { orderStatusUrl } from "./order-status-token.js";
 import { holdPromotionSlot, promotionHoldKey } from "./promotion-hold.js";
 import { buildRoute, claimAttempt, Route } from "@aglyn/aglyn/server";
 /**
@@ -158,12 +159,14 @@ import { buildRoute, claimAttempt, Route } from "@aglyn/aglyn/server";
                 error: 'Payments are not set up yet'
             });
         }
-        // Stripe returns the merchant to the console Products page. This was
-        // `/{hostDocId}/products`, the pre-AGL-621/622 shape, so paying (or
-        // cancelling) a draft order landed on a 404 (AGL-685). Console products
-        // is the plugin route keyed by org slug + host SUBDOMAIN; server code
-        // cannot call useConsoleHostRoute, so resolve them here. Without both,
-        // fall back to the origin root rather than a fabricated dead path.
+        // Where Stripe returns the BUYER is the business's own site (AGL-4094):
+        // the order's status page after paying, the site's home after backing
+        // out — see the params below. The console Products page is only the
+        // fallback for a site with no public address or no signing secret, which
+        // no published site lacks. Console products is the plugin route keyed by
+        // org slug + host SUBDOMAIN; server code cannot call
+        // useConsoleHostRoute, so resolve them here. Without both, fall back to
+        // the origin root rather than a fabricated dead path.
         const consoleSubdomain = (await firestore.collection('hostIndex').doc(hostId).get()).get('subdomain');
         const consoleOrgSlug = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.slug;
         // The console's own host, as the POS door reads it — never the `Origin`
@@ -625,6 +628,11 @@ import { buildRoute, claimAttempt, Route } from "@aglyn/aglyn/server";
                 });
             }
         }
+        // The buyer's way back, on the business's site: the order's status page
+        // (which reads the paid state from the server) and the site's home.
+        const siteData = hostSnapshot.data();
+        const buyerStatusUrl = orderStatusUrl(siteData, hostId, orderRef.id);
+        const buyerSiteUrl = buyerStatusUrl ? `${new URL(buyerStatusUrl).origin}/` : '';
         const params = new URLSearchParams(_extends({
             mode: 'payment'
         }, checkoutSessionCardAuthenticationParams('payment'), useStripeTax ? {
@@ -648,8 +656,8 @@ import { buildRoute, claimAttempt, Route } from "@aglyn/aglyn/server";
         }), email ? {
             customer_email: email
         } : {}, {
-            success_url: `${consoleProductsUrl}?draft=paid`,
-            cancel_url: `${consoleProductsUrl}?draft=canceled`,
+            success_url: buyerStatusUrl != null ? buyerStatusUrl : `${consoleProductsUrl}?draft=paid`,
+            cancel_url: buyerSiteUrl || `${consoleProductsUrl}?draft=canceled`,
             'metadata[type]': 'commerce-draft',
             'metadata[hostId]': hostId,
             'metadata[orderId]': orderRef.id,